| शीर्षक | Privoce vocechat <=0.9.121 Improper Neutralization of Alternate XSS Syntax |
|---|
| विवरण | The welcome query parameter on the widget.html page is not sanitized or encoded before being written directly into a dangerous DOM sink (e.g., innerHTML) by client-side JavaScript, resulting in a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session. This can be used to exfiltrate sensitive client-side data such as localStorage, sessionStorage, or accessible cookies, as well as to perform session hijacking, phishing, or malicious redirects.
Proof of Concept: http://localhost:3001/widget.html?welcome=<img src=x onerror="alert(JSON.stringify(localStorage))">
Trigger condition: Victim visits a link containing the malicious welcome parameter.
Root cause: User-controllable input from the URL is not HTML-escaped or sanitized before being inserted into a DOM-rendering sink on the client side. |
|---|
| स्रोत | ⚠️ https://github.com/H1ck1y/Vulnerabilities/blob/main/Vocechat_DomXss.md |
|---|
| उपयोगकर्ता | dyihan (UID 101533) |
|---|
| सबमिशन | 22/09/2026 03:21 PM (1 महीना पहले) |
|---|
| संयम | 24/10/2026 04:00 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 426123 [Privoce Vocechat तक 0.9.121 Query Parameter widget.html welcome क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|